suricata
|
Go to the source code of this file.
Typedefs | |
typedef struct AppLayerProtoDetectThreadCtx_ | AppLayerProtoDetectThreadCtx |
typedef AppProto(* | ProbingParserFPtr) (Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir) |
Functions | |
AppProto | AppLayerProtoDetectGetProto (AppLayerProtoDetectThreadCtx *tctx, Flow *f, const uint8_t *buf, uint32_t buflen, uint8_t ipproto, uint8_t flags, bool *reverse_flow) |
Returns the app layer protocol given a buffer. More... | |
int | AppLayerProtoDetectPrepareState (void) |
Prepares the internal state for protocol detection. This needs to be called once all the patterns and probing parser ports have been registered. More... | |
void | AppLayerProtoDetectPPRegister (uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2) |
register parser at a port More... | |
int | AppLayerProtoDetectPPParseConfPorts (const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc) |
int | AppLayerProtoDetectPMRegisterPatternCS (uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction) |
Registers a case-sensitive pattern for protocol detection. More... | |
int | AppLayerProtoDetectPMRegisterPatternCSwPP (uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth) |
int | AppLayerProtoDetectPMRegisterPatternCI (uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction) |
Registers a case-insensitive pattern for protocol detection. More... | |
int | AppLayerProtoDetectSetup (void) |
The first function to be called. This initializes a global protocol detection context. More... | |
void | AppLayerProtoDetectReset (Flow *) |
Reset proto detect for flow. More... | |
void | AppLayerRequestProtocolChange (Flow *f, uint16_t dp, AppProto expect_proto) |
request applayer to wrap up this protocol and rerun protocol detection. More... | |
void | AppLayerRequestProtocolTLSUpgrade (Flow *f) |
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS. Used by STARTTLS. More... | |
int | AppLayerProtoDetectDeSetup (void) |
Cleans up the app layer protocol detection phase. More... | |
void | AppLayerProtoDetectRegisterProtocol (AppProto alproto, const char *alproto_name) |
Registers a protocol for protocol detection phase. More... | |
void | AppLayerProtoDetectRegisterAlias (const char *proto_name, const char *proto_alias) |
int | AppLayerProtoDetectConfProtoDetectionEnabled (const char *ipproto, const char *alproto) |
Given a protocol name, checks if proto detection is enabled in the conf file. More... | |
AppLayerProtoDetectThreadCtx * | AppLayerProtoDetectGetCtxThread (void) |
Inits and returns an app layer protocol detection thread context. More... | |
void | AppLayerProtoDetectDestroyCtxThread (AppLayerProtoDetectThreadCtx *tctx) |
Destroys the app layer protocol detection thread context. More... | |
void | AppLayerProtoDetectSupportedIpprotos (AppProto alproto, uint8_t *ipprotos) |
AppProto | AppLayerProtoDetectGetProtoByName (const char *alproto_name) |
const char * | AppLayerProtoDetectGetProtoName (AppProto alproto) |
void | AppLayerProtoDetectSupportedAppProtocols (AppProto *alprotos) |
void | AppLayerRegisterExpectationProto (uint8_t proto, AppProto alproto) |
void | AppLayerProtoDetectUnittestCtxBackup (void) |
Backs up the internal context used by the app layer proto detection module. More... | |
void | AppLayerProtoDetectUnittestCtxRestore (void) |
Restores back the internal context used by the app layer proto detection module, that was previously backed up by calling AppLayerProtoDetectUnittestCtxBackup(). More... | |
void | AppLayerProtoDetectUnittestsRegister (void) |
Register unittests for app layer proto detection module. More... | |
Definition in file app-layer-detect-proto.h.
typedef struct AppLayerProtoDetectThreadCtx_ AppLayerProtoDetectThreadCtx |
Definition at line 1 of file app-layer-detect-proto.h.
typedef AppProto(* ProbingParserFPtr) (Flow *f, uint8_t flags, const uint8_t *input, uint32_t input_len, uint8_t *rdir) |
Definition at line 30 of file app-layer-detect-proto.h.
int AppLayerProtoDetectConfProtoDetectionEnabled | ( | const char * | ipproto, |
const char * | alproto | ||
) |
Given a protocol name, checks if proto detection is enabled in the conf file.
alproto | Name of the app layer protocol. |
1 | If enabled. |
0 | If disabled. |
Definition at line 1987 of file app-layer-detect-proto.c.
References BUG_ON, ConfGetNode(), ConfValIsFalse(), ConfValIsTrue(), FatalError, RunmodeIsUnittests(), SC_ERR_FATAL, SCEnter, SCLogDebug, SCLogError, SCReturnInt, and ConfNode_::val.
Referenced by AppLayerParserRegisterProtocolParsers(), HTPFreeConfig(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterENIPUDPParsers(), RegisterFTPParsers(), RegisterHTPParsers(), RegisterHTTP2Parsers(), RegisterModbusParsers(), RegisterNFSTCPParsers(), RegisterNFSUDPParsers(), RegisterSMBParsers(), RegisterSMTPParsers(), RegisterSSHParsers(), RegisterSSLParsers(), RegisterTemplateParsers(), and RegisterTFTPParsers().
int AppLayerProtoDetectDeSetup | ( | void | ) |
Cleans up the app layer protocol detection phase.
Definition at line 1857 of file app-layer-detect-proto.c.
References FLOW_PROTO_DEFAULT, PatIntId, and SCEnter.
Referenced by AppLayerDeSetup().
void AppLayerProtoDetectDestroyCtxThread | ( | AppLayerProtoDetectThreadCtx * | tctx | ) |
Destroys the app layer protocol detection thread context.
tctx | Pointer to the app layer protocol detection thread context. |
Definition at line 2102 of file app-layer-detect-proto.c.
References FLOW_PROTO_DEFAULT, and SCEnter.
Referenced by AppLayerDestroyCtxThread().
AppLayerProtoDetectThreadCtx* AppLayerProtoDetectGetCtxThread | ( | void | ) |
Inits and returns an app layer protocol detection thread context.
ctx | Pointer to the app layer protocol detection context. |
Pointer | to the thread context, on success; NULL, on failure. |
Definition at line 2048 of file app-layer-detect-proto.c.
References alpd_tctx, FLOW_PROTO_DEFAULT, PatIntId, and SCEnter.
Referenced by AppLayerGetCtxThread(), and LLVMFuzzerTestOneInput().
AppProto AppLayerProtoDetectGetProto | ( | AppLayerProtoDetectThreadCtx * | tctx, |
Flow * | f, | ||
const uint8_t * | buf, | ||
uint32_t | buflen, | ||
uint8_t | ipproto, | ||
uint8_t | flags, | ||
bool * | reverse_flow | ||
) |
Returns the app layer protocol given a buffer.
tctx | Pointer to the app layer protocol detection thread context. | |
f | Pointer to the flow. | |
buf | The buffer to be inspected. | |
buflen | The length of the above buffer. | |
ipproto | The ip protocol. | |
flags | The direction bitfield - STREAM_TOSERVER/STREAM_TOCLIENT. | |
[out] | reverse_flow | true if flow is detected to be reversed |
The | app layer protocol. |
Definition at line 1530 of file app-layer-detect-proto.c.
References ALPROTO_MAX, ALPROTO_UNKNOWN, flags, FLOW_IS_PM_DONE, SCEnter, SCLogDebug, and STREAM_TOSERVER.
Referenced by LLVMFuzzerTestOneInput().
AppProto AppLayerProtoDetectGetProtoByName | ( | const char * | alproto_name | ) |
Definition at line 2145 of file app-layer-detect-proto.c.
References SCEnter.
Referenced by AppLayerGetProtoByName().
const char* AppLayerProtoDetectGetProtoName | ( | AppProto | alproto | ) |
Definition at line 2170 of file app-layer-detect-proto.c.
Referenced by AppLayerGetProtoName().
int AppLayerProtoDetectPMRegisterPatternCI | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
const char * | pattern, | ||
uint16_t | depth, | ||
uint16_t | offset, | ||
uint8_t | direction | ||
) |
Registers a case-insensitive pattern for protocol detection.
Definition at line 1812 of file app-layer-detect-proto.c.
References SCEnter.
int AppLayerProtoDetectPMRegisterPatternCS | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
const char * | pattern, | ||
uint16_t | depth, | ||
uint16_t | offset, | ||
uint8_t | direction | ||
) |
Registers a case-sensitive pattern for protocol detection.
Definition at line 1785 of file app-layer-detect-proto.c.
References SCEnter.
Referenced by AppLayerParserRegisterProtocolParsers().
int AppLayerProtoDetectPMRegisterPatternCSwPP | ( | uint8_t | ipproto, |
AppProto | alproto, | ||
const char * | pattern, | ||
uint16_t | depth, | ||
uint16_t | offset, | ||
uint8_t | direction, | ||
ProbingParserFPtr | PPFunc, | ||
uint16_t | pp_min_depth, | ||
uint16_t | pp_max_depth | ||
) |
Definition at line 1798 of file app-layer-detect-proto.c.
References SCEnter.
int AppLayerProtoDetectPPParseConfPorts | ( | const char * | ipproto_name, |
uint8_t | ipproto, | ||
const char * | alproto_name, | ||
AppProto | alproto, | ||
uint16_t | min_depth, | ||
uint16_t | max_depth, | ||
ProbingParserFPtr | ProbingParserTs, | ||
ProbingParserFPtr | ProbingParserTc | ||
) |
bool | 0 if no config was found, 1 if config was found |
Definition at line 1711 of file app-layer-detect-proto.c.
References AppLayerProtoDetectPPRegister(), ConfGetNode(), ConfNodeLookupChild(), FatalError, SC_ERR_FATAL, SCEnter, SCLogDebug, SCReturnInt, STREAM_TOCLIENT, STREAM_TOSERVER, and ConfNode_::val.
void AppLayerProtoDetectPPRegister | ( | uint8_t | ipproto, |
const char * | portstr, | ||
AppProto | alproto, | ||
uint16_t | min_depth, | ||
uint16_t | max_depth, | ||
uint8_t | direction, | ||
ProbingParserFPtr | ProbingParser1, | ||
ProbingParserFPtr | ProbingParser2 | ||
) |
register parser at a port
direction | STREAM_TOSERVER or STREAM_TOCLIENT for dp or sp |
Definition at line 1677 of file app-layer-detect-proto.c.
References DetectPortParse(), head, DetectPort_::port, DetectPort_::port2, and SCEnter.
Referenced by AppLayerProtoDetectPPParseConfPorts(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterENIPUDPParsers(), RegisterModbusParsers(), RegisterTemplateParsers(), and RegisterTFTPParsers().
int AppLayerProtoDetectPrepareState | ( | void | ) |
Prepares the internal state for protocol detection. This needs to be called once all the patterns and probing parser ports have been registered.
Definition at line 1633 of file app-layer-detect-proto.c.
References FLOW_PROTO_DEFAULT, and SCEnter.
Referenced by AppLayerSetup().
void AppLayerProtoDetectRegisterAlias | ( | const char * | proto_name, |
const char * | proto_alias | ||
) |
Definition at line 1899 of file app-layer-detect-proto.c.
References AppLayerProtoDetectAliases_::next, AppLayerProtoDetectAliases_::proto_alias, AppLayerProtoDetectAliases_::proto_name, SCEnter, SCMalloc, and unlikely.
Referenced by AppLayerRegisterParserAlias().
void AppLayerProtoDetectRegisterProtocol | ( | AppProto | alproto, |
const char * | alproto_name | ||
) |
Registers a protocol for protocol detection phase.
This is the first function to be called after calling the setup function, AppLayerProtoDetectSetup(), before calling any other app layer functions, AppLayerParser or AppLayerProtoDetect, alike. With this function you are associating/registering a string that can be used by users to write rules, i.e. you register the http protocol for protocol detection using AppLayerProtoDetectRegisterProtocol(ctx, ALPROTO_HTTP1, "http"), following which you can write rules like - alert http any any -> any any (sid:1;) which basically matches on the HTTP protocol.
alproto | The protocol. |
alproto_str | The string to associate with the above "alproto". Please send a static string that won't be destroyed post making this call, since this function won't create a copy of the received argument. |
0 | On success; -1 On failure. |
Definition at line 1889 of file app-layer-detect-proto.c.
References SCEnter.
Referenced by AppLayerParserRegisterProtocolParsers(), RegisterDCERPCParsers(), RegisterDCERPCUDPParsers(), RegisterDNP3Parsers(), RegisterENIPTCPParsers(), RegisterENIPUDPParsers(), RegisterFTPParsers(), RegisterHTPParsers(), RegisterHTTP2Parsers(), RegisterModbusParsers(), RegisterSMBParsers(), RegisterSMTPParsers(), RegisterSSHParsers(), RegisterSSLParsers(), RegisterTemplateParsers(), and RegisterTFTPParsers().
void AppLayerProtoDetectReset | ( | Flow * | ) |
Reset proto detect for flow.
Definition at line 1968 of file app-layer-detect-proto.c.
References Flow_::alparser, Flow_::alproto, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, FLOW_RESET_PE_DONE, FLOW_RESET_PM_DONE, FLOW_RESET_PP_DONE, Flow_::probing_parser_toclient_alproto_masks, Flow_::probing_parser_toserver_alproto_masks, STREAM_TOCLIENT, and STREAM_TOSERVER.
int AppLayerProtoDetectSetup | ( | void | ) |
The first function to be called. This initializes a global protocol detection context.
0 | On succcess; |
-1 | On failure. |
Definition at line 1827 of file app-layer-detect-proto.c.
References SCEnter.
Referenced by AppLayerSetup(), and LLVMFuzzerTestOneInput().
void AppLayerProtoDetectSupportedAppProtocols | ( | AppProto * | alprotos | ) |
Definition at line 2175 of file app-layer-detect-proto.c.
References ALPROTO_MAX, and SCEnter.
Referenced by AppLayerListSupportedProtocols(), and AppLayerRegisterThreadCounters().
void AppLayerProtoDetectSupportedIpprotos | ( | AppProto | alproto, |
uint8_t * | ipprotos | ||
) |
Definition at line 2128 of file app-layer-detect-proto.c.
References ALPROTO_HTTP, ALPROTO_HTTP1, ALPROTO_HTTP2, AppLayerProtoDetectSupportedIpprotos(), and SCEnter.
Referenced by AppLayerProtoDetectSupportedIpprotos().
void AppLayerProtoDetectUnittestCtxBackup | ( | void | ) |
Backs up the internal context used by the app layer proto detection module.
Definition at line 2223 of file app-layer-detect-proto.c.
References SCEnter.
void AppLayerProtoDetectUnittestCtxRestore | ( | void | ) |
Restores back the internal context used by the app layer proto detection module, that was previously backed up by calling AppLayerProtoDetectUnittestCtxBackup().
Definition at line 2231 of file app-layer-detect-proto.c.
References SCEnter.
void AppLayerProtoDetectUnittestsRegister | ( | void | ) |
Register unittests for app layer proto detection module.
Definition at line 3744 of file app-layer-detect-proto.c.
References SCEnter, and UtRegisterTest().
void AppLayerRegisterExpectationProto | ( | uint8_t | proto, |
AppProto | alproto | ||
) |
Definition at line 2204 of file app-layer-detect-proto.c.
References expectation_proto, proto, SC_ERR_NOT_SUPPORTED, and SCLogError.
request applayer to wrap up this protocol and rerun protocol detection.
When this is called, the old session is reset unconditionally. A 'detect/log' flush packet is generated for both direction before the reset, so allow for final detection and logging.
f | flow to act on |
dp | destination port to use in protocol detection. Set to 443 for start tls, set to the HTTP uri port for CONNECT and set to 0 to not use it. |
expect_proto | expected protocol. AppLayer event will be set if detected protocol differs from this. |
Definition at line 1939 of file app-layer-detect-proto.c.
References Flow_::alproto, Flow_::alproto_expect, Flow_::alproto_orig, Flow_::alproto_tc, Flow_::alproto_ts, ALPROTO_UNKNOWN, DEBUG_VALIDATE_BUG_ON, FlowSetChangeProtoFlag(), and Flow_::protodetect_dp.
Referenced by AppLayerRequestProtocolTLSUpgrade().
void AppLayerRequestProtocolTLSUpgrade | ( | Flow * | f | ) |
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS. Used by STARTTLS.
Sets detection port to 443 to make port based TLS detection work for SMTP, FTP etc as well.
f | flow to act on |
Definition at line 1963 of file app-layer-detect-proto.c.
References ALPROTO_TLS, and AppLayerRequestProtocolChange().